Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

ACM SIGSAC Conference on Computer and Communications Security (CCS)

Post-Quantum Multi-Recipient Public Key Encryption

Joël Alwen, Dominik Hartmann, Eike Kiltz, Marta Mularczyk, Peter Schwabe

Published Nov 15, 2023• 13 citations
Publisher

Abstract

A multi-message multi-recipient PKE (mmPKE) encrypts a batch of messages, in one go, to a corresponding set of independently chosen receiver public keys. The resulting ''multi-recipient ciphertext'' can be then be reduced (by any 3rd party) to a shorter, receiver specific, ''invidual ciphertext.'' Finally, to recover the i-th message in the batch from their indvidual ciphertext the i-th receiver only needs their own decryption key. A special case of mmPKE is multi-recipient PKE (mPKE) where all receivers are sent the same message. By treating (m)mPKE and their KEM counterparts as a stand-alone primitives we allow for more efficient constructions than trivially composing individual PKE/KEM instances. This is especially valuable in the post-quantum setting, where PKE/KEM ciphertexts and public keys tend to be far larger than their classic counterparts.

DOI
10.1145/3576915.3623185

Related papers

A Verifiable Multi-recipient Encryption Scheme from Multilinear Maps

Zhengjun Jing, Guoping Jiang, Chunsheng Gu

Multi-recipient encryption is an important public key cryptosystem, which can be applied for a variety of purposes, such as broadcasting data. In order to design an secure multi-recipient public key encryption (MRPKE) in post-quantum era, in this paper, we construct a novel MRPKE scheme base on Garg-Gentry-Halevi (GGH) framework which is a graded algebras analogue of multilinear maps from ideal lattice. Under the grade decisional Diffie-Hellman (GDDH) assumption of GGH, the proposed scheme has semantically safety against chosen plaintext attack (CPA). At the same time, each recipient, without first decrypting, can verify whether the message to be received is from a legitimate sender. Furthermore, the encryption and decryption only involves the polynomial modular addition and multiplication in polynomial ring, so the efficiency of the proposed scheme is higher.

International Conference on P2P, Parallel, Grid, Cloud and Internet Computing (3PGCIC)•Nov 1, 2014•1 citation

A symmetric LWE-based Multi-Recipient Cryptosystem

Saikat Gope, Srinivasan Krishnaswamy, Chayan Bhawal

This article describes a post-quantum multirecipient symmetric cryptosystem whose security is based on the hardness of the LWE problem. In this scheme a single sender encrypts multiple messages for multiple recipients generating a single ciphertext which is broadcast to the recipients. Each recipient decrypts the ciphertext with her secret key to recover the message intended for her. In this process, the recipient cannot efficiently extract any information about the other messages. This scheme is intended for messages like images and sound that can tolerate a small amount of noise. This article introduces the scheme and establishes its security based on the LWE problem. Further, an example is given to demonstrate the application of this scheme for encrypting multiple images.

arXiv:2506.05711•Jun 6, 2025•0 citations

Quantum Public Key Encryption for NISQ Devices

Nishant Rodrigues, Walter O. Krawec, Brad Lackey +2 more

Quantum public-key encryption (PKE), where public-keys and/or ciphertexts can be quantum states, is an important primitive in quantum cryptography. Unlike classical PKE (e.g., RSA or ECC), quantum PKE can leverage quantumsecure cryptographic assumptions or the principles of quantum mechanics for security. It has great potential in providing for secure cryptographic systems under potentially weaker assumptions than is possible classically. In addition, it is of both practical and theoretical interest, opening the door to novel cryptographic systems not possible with classical information alone. While multiple quantum PKE schemes have been proposed, they require a large number of qubits acting coherently, and are not practical on current noisy quantum devices. In this paper, we design a practical quantum PKE scheme, taking into account the constraints of current NISQ devices. Specifically, we design a PKE scheme with quantum-classical public keys and classical ciphertexts, that is noise-resilient and only requires a small number of qubits acting coherently. In addition, our design provides tradeoffs in terms of efficiency and the number of qubits that are required.

arXiv:2509.17758•IEEE International Conference on Quantum Computing and Engineering (QCE)•Aug 30, 2025•1 citation

Trustless advanced encryption schemes from lattices

Jeffrey Champion

Public-key encryption (PKE) is an extremely useful cryptographic primitive, seeing constant use when browsing the internet. A PKE scheme is a simple way for users to communicate securely without exchanging any secret keys beforehand. However, PKE by itself only enables one-to-one communication. For example, in the simple setting of group messaging, where a user wishes to send a message to many other users simultaneously, vanilla PKE can become quite inefficient. In the decades following the introduction of PKE, numerous “advanced PKE” primitives were introduced. These include broadcast encryption, attributed-based encryption, functional encryption, threshold encryption, and many more. Such primitives typically achieve their additional functionality by assuming the existence of a central user who provides keys for the other users. Since this trust assumption is quite strong, there has been a recent line of work investigating the removal of such a trust assumption while still retaining the advanced functionality. Currently, these so-called trustless advanced PKE schemes can be constructed from pairing-based assumptions or strong tools like indistinguishability obfuscation and witness encryption. Notably, none of these schemes enjoy security from a reasonable post-quantum assumption. In this work, we make progress on filling this gap by constructing the first trustless advanced PKE schemes from simple lattice assumptions.

•Aug 1, 2026•0 citations

A Simple Construction of Quantum Public-Key Encryption from Quantum-Secure One-Way Functions

Khashayar Barooti, Giulio Malavolta, Michael Walter

Quantum public-key encryption [Gottesman; Kawachi et al., Eurocrypt'05] generalizes public-key encryption (PKE) by allowing the public keys to be quantum states. Prior work indicated that quantum PKE can be constructed from assumptions that are potentially weaker than those needed to realize its classical counterpart. In this work, we show that quantum PKE can be constructed from any quantum-secure one-way function. In contrast, classical PKE is believed to require more structured assumptions. Our construction is simple, uses only classical ciphertexts, and satisfies the strong notion of CCA security.

arXiv:2303.01143•Mar 2, 2023•1 citation

Simple PKE schemes from the TSPEM problem

Limin Zhou, Qiuyang Wang

In the quantum era, the advent of quantum computers poses significant threats to the security of current cryptosystems. Therefore, designing quantum-resistant cryptoschemes becomes important to guarantee information security. This work concentrates on the development of the post-quantum public key encryption (PKE) scheme. Non-commutative cryptography (NCC) has entered the field of post-quantum cryptography. We utilize the TSPEM problem with asymmetric structures (which serve as a potential candiate for resisting quantum attacks) to construct two PKE schemes which are demonstrated to be CPA security under the DTSPEM assumption. By representing the plaintext as a matrix, these schemes can effectively encrypt a significant amount of information in a single operation. Assuming an equal amount of messages for encryption, the proposed schemes acheive superior efficiency compared to existing PKE schemes. Structurally, our systems exhibit a level of synchronization and coexistence due to the distinct public keys $ (P) $ and ciphertexts $ (C_{1}) $. The efficiency analysis is conducted by comparing known schemes from the aspect of specific cryptographic indicators. Generally, the proposed ones offer several advantages including provable security, high efficiency, potential quantum-resistant, and relative ease of implementation; along with synchronization and coexistence. Our investigation has established the feasibility of constructing PKE schemes based on the TSPEM problem, specifically for asymmetric communication scenarios. The preliminary results pave the way for further exploration of the TSPEM problem$ ' $s potential in developing other cryptosystems suitable for quantum computing environments.

AIMS Mathematics•Jan 1, 2024•0 citations
A multi-message multi-recipient PKE (mmPKE) encrypts a batch of messages, in one go, to a corresponding set of independently chosen receiver public keys. The resulting ''multi-recipient ciphertext'' can be then be reduced (by any 3rd party) to a shorter, receiver specific, ''invidual ciphertext.'' Finally, to recover the i-th message in the batch from their indvidual ciphertext the i-th receiver only needs their own decryption key. A special case of mmPKE is multi-recipient PKE (mPKE) where all receivers are sent the same message. By treating (m)mPKE and their KEM counterparts as a stand-alone primitives we allow for more efficient constructions than trivially composing individual PKE/KEM instances. This is especially valuable in the post-quantum setting, where PKE/KEM ciphertexts and public keys tend to be far larger than their classic counterparts.
Multi-recipient encryption is an important public key cryptosystem, which can be applied for a variety of purposes, such as broadcasting data. In order to design an secure multi-recipient public key encryption (MRPKE) in post-quantum era, in this paper, we construct a novel MRPKE scheme base on Garg-Gentry-Halevi (GGH) framework which is a graded algebras analogue of multilinear maps from ideal lattice. Under the grade decisional Diffie-Hellman (GDDH) assumption of GGH, the proposed scheme has semantically safety against chosen plaintext attack (CPA). At the same time, each recipient, without first decrypting, can verify whether the message to be received is from a legitimate sender. Furthermore, the encryption and decryption only involves the polynomial modular addition and multiplication in polynomial ring, so the efficiency of the proposed scheme is higher.
This article describes a post-quantum multirecipient symmetric cryptosystem whose security is based on the hardness of the LWE problem. In this scheme a single sender encrypts multiple messages for multiple recipients generating a single ciphertext which is broadcast to the recipients. Each recipient decrypts the ciphertext with her secret key to recover the message intended for her. In this process, the recipient cannot efficiently extract any information about the other messages. This scheme is intended for messages like images and sound that can tolerate a small amount of noise. This article introduces the scheme and establishes its security based on the LWE problem. Further, an example is given to demonstrate the application of this scheme for encrypting multiple images.
Quantum public-key encryption (PKE), where public-keys and/or ciphertexts can be quantum states, is an important primitive in quantum cryptography. Unlike classical PKE (e.g., RSA or ECC), quantum PKE can leverage quantumsecure cryptographic assumptions or the principles of quantum mechanics for security. It has great potential in providing for secure cryptographic systems under potentially weaker assumptions than is possible classically. In addition, it is of both practical and theoretical interest, opening the door to novel cryptographic systems not possible with classical information alone. While multiple quantum PKE schemes have been proposed, they require a large number of qubits acting coherently, and are not practical on current noisy quantum devices. In this paper, we design a practical quantum PKE scheme, taking into account the constraints of current NISQ devices. Specifically, we design a PKE scheme with quantum-classical public keys and classical ciphertexts, that is noise-resilient and only requires a small number of qubits acting coherently. In addition, our design provides tradeoffs in terms of efficiency and the number of qubits that are required.
Public-key encryption (PKE) is an extremely useful cryptographic primitive, seeing constant use when browsing the internet. A PKE scheme is a simple way for users to communicate securely without exchanging any secret keys beforehand. However, PKE by itself only enables one-to-one communication. For example, in the simple setting of group messaging, where a user wishes to send a message to many other users simultaneously, vanilla PKE can become quite inefficient. In the decades following the introduction of PKE, numerous “advanced PKE” primitives were introduced. These include broadcast encryption, attributed-based encryption, functional encryption, threshold encryption, and many more. Such primitives typically achieve their additional functionality by assuming the existence of a central user who provides keys for the other users. Since this trust assumption is quite strong, there has been a recent line of work investigating the removal of such a trust assumption while still retaining the advanced functionality. Currently, these so-called trustless advanced PKE schemes can be constructed from pairing-based assumptions or strong tools like indistinguishability obfuscation and witness encryption. Notably, none of these schemes enjoy security from a reasonable post-quantum assumption. In this work, we make progress on filling this gap by constructing the first trustless advanced PKE schemes from simple lattice assumptions.
Quantum public-key encryption [Gottesman; Kawachi et al., Eurocrypt'05] generalizes public-key encryption (PKE) by allowing the public keys to be quantum states. Prior work indicated that quantum PKE can be constructed from assumptions that are potentially weaker than those needed to realize its classical counterpart. In this work, we show that quantum PKE can be constructed from any quantum-secure one-way function. In contrast, classical PKE is believed to require more structured assumptions. Our construction is simple, uses only classical ciphertexts, and satisfies the strong notion of CCA security.
In the quantum era, the advent of quantum computers poses significant threats to the security of current cryptosystems. Therefore, designing quantum-resistant cryptoschemes becomes important to guarantee information security. This work concentrates on the development of the post-quantum public key encryption (PKE) scheme. Non-commutative cryptography (NCC) has entered the field of post-quantum cryptography. We utilize the TSPEM problem with asymmetric structures (which serve as a potential candiate for resisting quantum attacks) to construct two PKE schemes which are demonstrated to be CPA security under the DTSPEM assumption. By representing the plaintext as a matrix, these schemes can effectively encrypt a significant amount of information in a single operation. Assuming an equal amount of messages for encryption, the proposed schemes acheive superior efficiency compared to existing PKE schemes. Structurally, our systems exhibit a level of synchronization and coexistence due to the distinct public keys $ (P) $ and ciphertexts $ (C_{1}) .Theefficiencyanalysisisconductedbycomparingknownschemesfromtheaspectofspecificcryptographicindicators.Generally,theproposedonesofferseveraladvantagesincludingprovablesecurity,highefficiency,potentialquantum−resistant,andrelativeeaseofimplementation;alongwithsynchronizationandcoexistence.OurinvestigationhasestablishedthefeasibilityofconstructingPKEschemesbasedontheTSPEMproblem,specificallyforasymmetriccommunicationscenarios.ThepreliminaryresultspavethewayforfurtherexplorationoftheTSPEMproblem. The efficiency analysis is conducted by comparing known schemes from the aspect of specific cryptographic indicators. Generally, the proposed ones offer several advantages including provable security, high efficiency, potential quantum-resistant, and relative ease of implementation; along with synchronization and coexistence. Our investigation has established the feasibility of constructing PKE schemes based on the TSPEM problem, specifically for asymmetric communication scenarios. The preliminary results pave the way for further exploration of the TSPEM problem.Theefficiencyanalysisisconductedbycomparingknownschemesfromtheaspectofspecificcryptographicindicators.Generally,theproposedonesofferseveraladvantagesincludingprovablesecurity,highefficiency,potentialquantum−resistant,andrelativeeaseofimplementation;alongwithsynchronizationandcoexistence.OurinvestigationhasestablishedthefeasibilityofconstructingPKEschemesbasedontheTSPEMproblem,specificallyforasymmetriccommunicationscenarios.ThepreliminaryresultspavethewayforfurtherexplorationoftheTSPEMproblem ' $s potential in developing other cryptosystems suitable for quantum computing environments.